A dual-stage deep learning model based on a sparse autoencoder and layered deep classifier for intrusion detection with imbalanced data

In cybersecurity, intrusion detection systems (IDSs) play a crucial role in identifying potential vulnerability exploits, thus reinforcing the network's defense infrastructure. Integrating machine learning models into IDS development has improved detection of complex and evolving intrusion patterns. However, imbalanced training data hampers model effectiveness, leading to classification inaccuracies and false alarms. This study proposes an IDS model using a dual-stage deep learning approach to address class imbalance. Initially, a sparse autoencoder (SAE) detects anomalies and extracts features. The subsequent stage employs a layered deep learning model combining convolutional neural network (CNN) and bidirectional long short-term memory (Bi-LSTM) architectures for multiclass classification. The model uses a cross-entropy loss function with proportional class weights. Evaluation on the NSL-KDD dataset demonstrates significant enhancements in overall accuracy, recall rate, and false positive rate, particularly for minority classes, showcasing its competitiveness against baseline models and other approaches.